Security update for SES 1.0 SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2015:1102-1 Final 1 1 2015-05-31T20:53:33Z current 2015-05-31T20:53:33Z 2015-05-31T20:53:33Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for SES 1.0 This collective update for SUSE Enterprise Storage 1.0 provides fixes and enhancements. ceph (update to version 0.80.9): - Support non-ASCII characters. (bnc#907510) - Fixes issue with more than one OSD / MON on same node. (bnc#927862) - Reinstates Environment=CLUSTER=ceph lines removed by last patch. (bnc#915567) - Use same systemd service files for all cluster names. (bnc#915567) - In OSDMonitor fallback to json-pretty in case of invalid formatter. (bnc#919313) - Increase max files to 131072 for ceph-osd daemon. (bnc#924894) - Fix 'OSDs shutdown during rados benchmark tests'. (bnc#924269) - Add SuSEfirewall2 service files for Ceph MON, OSD and MDS. (bnc#919091) - Added support for multiple cluster names with systemd to ceph-disk. (bnc#915567) - Move udev rules for rbd devices to the client package ceph-common. - Several issues reported upstream have been fixed: #9973 #9918 #9907 #9877 #9854 #9587 #9479 #9478 #9254 #5595 #10978 #10965 #10907 #10553 #10471 #10421 #10307 #10299 #10271 #10271 #10270 #10262 #10103 #10095. ceph-deploy: - Drop support for multiple customer names on the same hardware. (bsc#915567) - Check for errors when generating rgw keys. (bsc#915783) - Do not import new repository keys automatically when installing packages with Zypper. (bsc#919965) - Improved detection of disk vs. OSD block devices with a simple set of tests. (bsc#889053) - Do not create keyring files as world-readable. (bsc#920926, CVE-2015-3010) - Added support for multiple cluster names with systemd to ceph-disk. (bnc#915567) calamari-clients: - Reduce krakenFailThreshold to 5 minutes. (bsc#903007) python-Pillow (update to version 2.7.0): - Fix issues in Jpeg2KImagePlugin and IcnsImagePlugin which could have allowed denial of service attacks. (CVE-2014-3598, CVE-2014-3589) python-djangorestframework: - Escape URLs when replacing format= query parameter, as used in dropdown on GET button in browsable API to allow explicit selection of JSON vs HTML output. (bsc#929914) - Escape request path when it is include as part of the login and logout links in the browsable API. (bsc#929886) For a comprehensive list of changes please refer to each package's change log. The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). SUSE-Storage-1.0-2015-250 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2015/suse-su-20151102-1/ Link for SUSE-SU-2015:1102-1 https://lists.suse.com/pipermail/sle-security-updates/2015-June/001450.html E-Mail link for SUSE-SU-2015:1102-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/889053 SUSE Bug 889053 https://bugzilla.suse.com/903007 SUSE Bug 903007 https://bugzilla.suse.com/907510 SUSE Bug 907510 https://bugzilla.suse.com/915567 SUSE Bug 915567 https://bugzilla.suse.com/915783 SUSE Bug 915783 https://bugzilla.suse.com/919091 SUSE Bug 919091 https://bugzilla.suse.com/919313 SUSE Bug 919313 https://bugzilla.suse.com/919965 SUSE Bug 919965 https://bugzilla.suse.com/920926 SUSE Bug 920926 https://bugzilla.suse.com/924269 SUSE Bug 924269 https://bugzilla.suse.com/924894 SUSE Bug 924894 https://bugzilla.suse.com/927862 SUSE Bug 927862 https://bugzilla.suse.com/929553 SUSE Bug 929553 https://bugzilla.suse.com/929886 SUSE Bug 929886 https://bugzilla.suse.com/929914 SUSE Bug 929914 https://www.suse.com/security/cve/CVE-2014-3589/ SUSE CVE CVE-2014-3589 page https://www.suse.com/security/cve/CVE-2014-3598/ SUSE CVE CVE-2014-3598 page https://www.suse.com/security/cve/CVE-2015-3010/ SUSE CVE CVE-2015-3010 page SUSE Enterprise Storage 1.0 calamari-clients-1.2.2+git.1428648634.40dfe5b-3.1 ceph-0.80.9-5.1 ceph-common-0.80.9-5.1 ceph-deploy-1.5.19+git.1431355031.6178cf3-9.1 ceph-fuse-0.80.9-5.1 ceph-radosgw-0.80.9-5.1 ceph-test-0.80.9-5.1 libcephfs1-0.80.9-5.1 librados2-0.80.9-5.1 librbd1-0.80.9-5.1 python-Pillow-2.7.0-4.1 python-ceph-0.80.9-5.1 python-djangorestframework-2.3.12-4.2 rbd-fuse-0.80.9-5.1 calamari-clients-1.2.2+git.1428648634.40dfe5b-3.1 as a component of SUSE Enterprise Storage 1.0 ceph-0.80.9-5.1 as a component of SUSE Enterprise Storage 1.0 ceph-common-0.80.9-5.1 as a component of SUSE Enterprise Storage 1.0 ceph-deploy-1.5.19+git.1431355031.6178cf3-9.1 as a component of SUSE Enterprise Storage 1.0 ceph-fuse-0.80.9-5.1 as a component of SUSE Enterprise Storage 1.0 ceph-radosgw-0.80.9-5.1 as a component of SUSE Enterprise Storage 1.0 ceph-test-0.80.9-5.1 as a component of SUSE Enterprise Storage 1.0 libcephfs1-0.80.9-5.1 as a component of SUSE Enterprise Storage 1.0 librados2-0.80.9-5.1 as a component of SUSE Enterprise Storage 1.0 librbd1-0.80.9-5.1 as a component of SUSE Enterprise Storage 1.0 python-Pillow-2.7.0-4.1 as a component of SUSE Enterprise Storage 1.0 python-ceph-0.80.9-5.1 as a component of SUSE Enterprise Storage 1.0 python-djangorestframework-2.3.12-4.2 as a component of SUSE Enterprise Storage 1.0 rbd-fuse-0.80.9-5.1 as a component of SUSE Enterprise Storage 1.0 PIL/IcnsImagePlugin.py in Python Imaging Library (PIL) and Pillow before 2.3.2 and 2.5.x before 2.5.2 allows remote attackers to cause a denial of service via a crafted block size. CVE-2014-3589 SUSE Enterprise Storage 1.0:calamari-clients-1.2.2+git.1428648634.40dfe5b-3.1 SUSE Enterprise Storage 1.0:ceph-0.80.9-5.1 SUSE Enterprise Storage 1.0:ceph-common-0.80.9-5.1 SUSE Enterprise Storage 1.0:ceph-deploy-1.5.19+git.1431355031.6178cf3-9.1 SUSE Enterprise Storage 1.0:ceph-fuse-0.80.9-5.1 SUSE Enterprise Storage 1.0:ceph-radosgw-0.80.9-5.1 SUSE Enterprise Storage 1.0:ceph-test-0.80.9-5.1 SUSE Enterprise Storage 1.0:libcephfs1-0.80.9-5.1 SUSE Enterprise Storage 1.0:librados2-0.80.9-5.1 SUSE Enterprise Storage 1.0:librbd1-0.80.9-5.1 SUSE Enterprise Storage 1.0:python-Pillow-2.7.0-4.1 SUSE Enterprise Storage 1.0:python-ceph-0.80.9-5.1 SUSE Enterprise Storage 1.0:python-djangorestframework-2.3.12-4.2 SUSE Enterprise Storage 1.0:rbd-fuse-0.80.9-5.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2015/suse-su-20151102-1/ https://www.suse.com/security/cve/CVE-2014-3589.html CVE-2014-3589 https://bugzilla.suse.com/921566 SUSE Bug 921566 The Jpeg2KImagePlugin plugin in Pillow before 2.5.3 allows remote attackers to cause a denial of service via a crafted image. CVE-2014-3598 SUSE Enterprise Storage 1.0:calamari-clients-1.2.2+git.1428648634.40dfe5b-3.1 SUSE Enterprise Storage 1.0:ceph-0.80.9-5.1 SUSE Enterprise Storage 1.0:ceph-common-0.80.9-5.1 SUSE Enterprise Storage 1.0:ceph-deploy-1.5.19+git.1431355031.6178cf3-9.1 SUSE Enterprise Storage 1.0:ceph-fuse-0.80.9-5.1 SUSE Enterprise Storage 1.0:ceph-radosgw-0.80.9-5.1 SUSE Enterprise Storage 1.0:ceph-test-0.80.9-5.1 SUSE Enterprise Storage 1.0:libcephfs1-0.80.9-5.1 SUSE Enterprise Storage 1.0:librados2-0.80.9-5.1 SUSE Enterprise Storage 1.0:librbd1-0.80.9-5.1 SUSE Enterprise Storage 1.0:python-Pillow-2.7.0-4.1 SUSE Enterprise Storage 1.0:python-ceph-0.80.9-5.1 SUSE Enterprise Storage 1.0:python-djangorestframework-2.3.12-4.2 SUSE Enterprise Storage 1.0:rbd-fuse-0.80.9-5.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2015/suse-su-20151102-1/ https://www.suse.com/security/cve/CVE-2014-3598.html CVE-2014-3598 https://bugzilla.suse.com/921566 SUSE Bug 921566 ceph-deploy before 1.5.23 uses weak permissions (644) for ceph/ceph.client.admin.keyring, which allows local users to obtain sensitive information by reading the file. CVE-2015-3010 SUSE Enterprise Storage 1.0:calamari-clients-1.2.2+git.1428648634.40dfe5b-3.1 SUSE Enterprise Storage 1.0:ceph-0.80.9-5.1 SUSE Enterprise Storage 1.0:ceph-common-0.80.9-5.1 SUSE Enterprise Storage 1.0:ceph-deploy-1.5.19+git.1431355031.6178cf3-9.1 SUSE Enterprise Storage 1.0:ceph-fuse-0.80.9-5.1 SUSE Enterprise Storage 1.0:ceph-radosgw-0.80.9-5.1 SUSE Enterprise Storage 1.0:ceph-test-0.80.9-5.1 SUSE Enterprise Storage 1.0:libcephfs1-0.80.9-5.1 SUSE Enterprise Storage 1.0:librados2-0.80.9-5.1 SUSE Enterprise Storage 1.0:librbd1-0.80.9-5.1 SUSE Enterprise Storage 1.0:python-Pillow-2.7.0-4.1 SUSE Enterprise Storage 1.0:python-ceph-0.80.9-5.1 SUSE Enterprise Storage 1.0:python-djangorestframework-2.3.12-4.2 SUSE Enterprise Storage 1.0:rbd-fuse-0.80.9-5.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2015/suse-su-20151102-1/ https://www.suse.com/security/cve/CVE-2015-3010.html CVE-2015-3010 https://bugzilla.suse.com/920926 SUSE Bug 920926 https://bugzilla.suse.com/933028 SUSE Bug 933028